imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

contrib/expat: import expat 2.8.3

Browse Source 
Changes: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes

Security:	CVE-2026-72522
MFC after:	1 week
This commit is contained in:
Philip Paeps committed 2026-08-11 07:30:15 +08:00
2 parents a6999a1c94 ef5aa86648
commit 207d96dabf
88 files changed
+455 -82
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

contrib/expat/Changes
+77 -20
View File
@@ -6,29 +6,82 @@
|_| XML parser
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! <blink>Expat is UNDERSTAFFED and WITHOUT FUNDING.</blink> !!
!! ~~~~~~~~~~~~ !!
!! The following topics need *additional skilled C developers* to progress !!
!! in a timely manner or at all (loosely ordered by descending priority): !!
!! _______________________ !!
!! - teaming up on fixing the UNFIXED SECURITY ISSUES listed at: !!
!! """"""""""""""""""""""" !!
!! https://github.com/libexpat/libexpat/issues/1160 !!
!! <blink>Expat has UNFIXED SECURITY ISSUES!</blink> !!
!! Please see https://github.com/libexpat/libexpat/issues/1160 for details. !!
!! !!
!! - teaming up on researching and fixing future security reports and !!
!! ClusterFuzz findings with few-days-max response times in communication !!
!! in order to (1) have a sound fix ready before the end of a 90 days !!
!! grace period and (2) in a sustainable manner, !!
!! !!
!! - implementing and auto-testing XML 1.0r5 support !!
!! (needs discussion before pull requests), !!
!! !!
!! For details, please reach out via e-mail to [email protected] so we !!
!! can schedule a voice call on the topic, in English or German. !!
!! !!
!! THANK YOU! Sebastian Pipping -- Berlin, 2026-03-17 !!
!! Starting 2026-08-01, for up to six months my work maintaining libexpat !!
!! will be funded by the City of Munich as part of their !!
!! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) !!
!! — thank you! !!
!! Sebastian Pipping -- Berlin, 2026-08-03 !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Release 2.8.3 Mon August 10 2026
Security fixes:
#1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
infinite loop caused by treating low surrogates (Unicode)
the same as high surrogates in functions *_toUtf16.
Needs Expat compiled with 16bit character support
(e.g. with Firefox and/or on Windows) to be affected.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote, the "AV:L" in NVD by
Mitre is mistaken.)
Original bug report from Mozilla at:
https://bugzilla.mozilla.org/show_bug.cgi?id=2053153
Bug fixes:
#1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2)
#1286 lib: Reject empty version in the XML declaration
#1305 #1306 lib: Fix printf format for AIX
Other changes:
#1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX
#1295 CMake|Windows: Add a 64bit MinGW toolchain file
#1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8
#1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later
#1300 Document the current wrap-around issues with functions
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetAttributeInfo
explicitly.
#1303 Address Clang Static Analyzer 22 warning
`core.NullPointerArithm`
#1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2)
to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/
for what these numbers do
Infrastructure:
#1311 CI: Limit workflow runtime and package installation runtime
#1310 CI: Pin Cppcheck version for a robust CI
#1310 CI: Migrate Cppcheck CI from macOS to Linux
#1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten
and WASI SDK
#1304 CI: Activate AddressSanitizer for MSVC Windows CI
#1308 CI: Introduce zizmor static analysis for GitHub Actions
#1308 CI: Start using `persist-credentials: false` with Git checkout
#1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions
#1302 #1303 CI: Bump Clang from 21 to 22
#1293 #1294 Update project status for 2026-08
#1301 #1307 Add SPDX license identifiers to the source code
Special thanks to:
Evgeny Kotkov
Henri Sivonen
Kartik Kenchi
Matthew Fernandez
Matthew Wozniczka
Stan Ulbrych
Tuukka Pasanen
William Woodruff
and
Anthropic
City of Munich Open Source Sabbatical
Mozilla Security Team
Subversion
zizmor static analysis
Release 2.8.2 Thu June 25 2026
Security fixes:
#1246 CVE-2026-50219 -- Disallow calls to functions
@@ -124,6 +177,10 @@ Release 2.8.1 Sun May 10 2026
through moderately sized crafted XML input (CWE-407).
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote and the "AC:L"
for low complexity; the NVD entry from Mitre is mistaken.)
Other changes:
#1209 #1213 Drop more casts related to `void *` that C99 does not need
contrib/expat/Makefile.am
+2 -1
View File
@@ -75,7 +75,8 @@ _EXTRA_DIST_CMAKE = \
cmake/autotools/expat-noconfig__macos.cmake.in \
cmake/autotools/expat-noconfig__windows.cmake.in \
cmake/autotools/expat-package-init.cmake \
cmake/mingw-toolchain.cmake \
cmake/mingw-toolchain-win32.cmake \
cmake/mingw-toolchain-win64.cmake \
\
CMakeLists.txt \
CMake.README \
contrib/expat/Makefile.in
+2 -1
View File
@@ -481,7 +481,8 @@ _EXTRA_DIST_CMAKE = \
cmake/autotools/expat-noconfig__macos.cmake.in \
cmake/autotools/expat-noconfig__windows.cmake.in \
cmake/autotools/expat-package-init.cmake \
cmake/mingw-toolchain.cmake \
cmake/mingw-toolchain-win32.cmake \
cmake/mingw-toolchain-win64.cmake \
\
CMakeLists.txt \
CMake.README \
contrib/expat/README.md
+10 -4
View File
@@ -6,12 +6,18 @@
> [!CAUTION]
>
> Expat is **understaffed** and without funding.
> There is a [call for help with details](https://github.com/libexpat/libexpat/blob/master/expat/Changes)
> at the top of the `Changes` file.
> Expat has **unfixed security issues**!
> Please see https://github.com/libexpat/libexpat/issues/1160 for details.
> [!NOTE]
>
> Starting 2026-08-01, for up to six months my work maintaining libexpat
> will be funded by the [City of Munich](https://en.wikipedia.org/wiki/Munich)
> as part of their [Open Source Sabbatical](https://opensource.muenchen.de/software/libexpat.html#open-source-sabbatical).
> Thank you! :heart: :pray:
# Expat, Release 2.8.2
# Expat, Release 2.8.3
This is Expat, a C99 library for parsing
[XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by
contrib/expat/configure.ac
+1 -1
View File
@@ -90,7 +90,7 @@ dnl If the API changes incompatibly set LIBAGE back to 0
dnl
LIBCURRENT=13 # sync
LIBREVISION=2 # with
LIBREVISION=3 # with
LIBAGE=12 # CMakeLists.txt!
AC_CONFIG_HEADERS([expat_config.h])
contrib/expat/doc/reference.html
+29 -1
View File
@@ -53,7 +53,7 @@
<body>
<div>
<h1>
The Expat XML Parser <small>Release 2.8.2</small>
The Expat XML Parser <small>Release 2.8.3</small>
</h1>
</div>
@@ -2917,6 +2917,13 @@ XML_GetCurrentByteIndex(XML_Parser p);
<code><a href="#XML_GetCurrentColumnNumber">XML_GetCurrentColumnNumber</a></code>.
</div>
<p>
<strong>Note:</strong> Type <code>XML_Index</code> is known to wrap around on
32bit platforms and 64bit Windows unless Expat has been compiled with
(non-default and uncommon) macro <code><a href=
"#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>.
</p>
<h4 id="XML_GetCurrentLineNumber">
XML_GetCurrentLineNumber
</h4>
@@ -2930,6 +2937,13 @@ XML_GetCurrentLineNumber(XML_Parser p);
<code>1</code>.
</div>
<p>
<strong>Note:</strong> Type <code>XML_Size</code> is known to wrap around on
32bit platforms and 64bit Windows unless Expat has been compiled with
(non-default and uncommon) macro <code><a href=
"#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>.
</p>
<h4 id="XML_GetCurrentColumnNumber">
XML_GetCurrentColumnNumber
</h4>
@@ -2943,6 +2957,13 @@ XML_GetCurrentColumnNumber(XML_Parser p);
position. The first column is reported as <code>0</code>.
</div>
<p>
<strong>Note:</strong> Type <code>XML_Size</code> is known to wrap around on
32bit platforms and 64bit Windows unless Expat has been compiled with
(non-default and uncommon) macro <code><a href=
"#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>.
</p>
<h4 id="XML_GetCurrentByteCount">
XML_GetCurrentByteCount
</h4>
@@ -3405,6 +3426,13 @@ typedef struct {
<code>XML_GetSpecifiedAttributeCount(parser) / 2</code>.
</div>
<p>
<strong>Note:</strong> Type <code>XML_Index</code> is known to wrap around on
32bit platforms and 64bit Windows unless Expat has been compiled with
(non-default and uncommon) macro <code><a href=
"#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>.
</p>
<h4 id="XML_SetEncoding">
XML_SetEncoding
</h4>
contrib/expat/doc/xmlwf.1
+1 -1
View File
@@ -5,7 +5,7 @@
\\$2 \(la\\$1\(ra\\$3
..
.if \n(.g .mso www.tmac
.TH XMLWF 1 "June 25, 2026" "" ""
.TH XMLWF 1 "August 10, 2026" "" ""
.SH NAME
xmlwf \- Determines if an XML document is well-formed
.SH SYNOPSIS
contrib/expat/doc/xmlwf.xml
+1 -1
View File
@@ -21,7 +21,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
<!ENTITY dhfirstname "<firstname>Scott</firstname>">
<!ENTITY dhsurname "<surname>Bronson</surname>">
<!ENTITY dhdate "<date>June 25, 2026</date>">
<!ENTITY dhdate "<date>August 10, 2026</date>">
<!-- Please adjust this^^ date whenever cutting a new release. -->
<!ENTITY dhsection "<manvolnum>1</manvolnum>">
<!ENTITY dhemail "<email>[email protected]</email>">
contrib/expat/examples/element_declarations.c
+2
View File
@@ -37,6 +37,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include <stdbool.h>
contrib/expat/examples/elements.c
+2
View File
@@ -37,6 +37,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include <stdio.h>
contrib/expat/examples/outline.c
+2
View File
@@ -34,6 +34,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include <stdio.h>
contrib/expat/lib/ascii.h
+2
View File
@@ -31,6 +31,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#define ASCII_A 0x41
contrib/expat/lib/asciitab.h
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
/* 0x00 */ BT_NONXML, BT_NONXML, BT_NONXML, BT_NONXML,
contrib/expat/lib/expat.h
+3 -1
View File
@@ -40,6 +40,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifndef Expat_INCLUDED
@@ -1094,7 +1096,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
*/
# define XML_MAJOR_VERSION 2
# define XML_MINOR_VERSION 8
# define XML_MICRO_VERSION 2
# define XML_MICRO_VERSION 3
# ifdef __cplusplus
}
contrib/expat/lib/expat_external.h
+2
View File
@@ -36,6 +36,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifndef Expat_External_INCLUDED
contrib/expat/lib/fallthrough.h
+2
View File
@@ -27,6 +27,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifndef FALLTHROUGH_H
contrib/expat/lib/iasciitab.h
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
/* Like asciitab.h, except that 0xD has code BT_S rather than BT_CR */
contrib/expat/lib/internal.h
+5 -12
View File
@@ -53,6 +53,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(__GNUC__) && defined(__i386__) && ! defined(__MINGW32__)
@@ -123,20 +125,11 @@
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
# endif
#else
# include <inttypes.h> // PRIdPTR, PRIuPTR
# define EXPAT_FMT_LLX(midpart) "%" midpart "llx"
# define EXPAT_FMT_ULL(midpart) "%" midpart "llu"
# if ! defined(ULONG_MAX)
# error Compiler did not define ULONG_MAX for us
# elif ULONG_MAX == 18446744073709551615u // 2^64-1
# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld"
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "lu"
# elif defined(__wasm32__) // 32bit mode Emscripten or WASI SDK
# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld"
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "zu"
# else
# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "d"
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
# endif
# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart PRIdPTR
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart PRIuPTR
#endif
#ifndef UNUSED_P
contrib/expat/lib/latin1tab.h
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
/* 0x80 */ BT_OTHER, BT_OTHER, BT_OTHER, BT_OTHER,
contrib/expat/lib/memory_sanitizer.h
+2
View File
@@ -27,6 +27,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if ! defined(MEMORY_SANITIZER_H)
contrib/expat/lib/nametab.h
+2
View File
@@ -28,6 +28,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
static const unsigned namingBitmap[] = {
contrib/expat/lib/random_arc4random.c
+2
View File
@@ -28,6 +28,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "random_arc4random.h"
contrib/expat/lib/random_arc4random.h
+2
View File
@@ -27,6 +27,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if ! defined(RANDOM_ACR4RANDOM_H)
contrib/expat/lib/random_arc4random_buf.c
+2
View File
@@ -28,6 +28,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "random_arc4random_buf.h"
contrib/expat/lib/random_arc4random_buf.h
+2
View File
@@ -27,6 +27,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if ! defined(RANDOM_ACR4RANDOM_BUF_H)
contrib/expat/lib/random_dev_urandom.c
+2
View File
@@ -28,6 +28,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "random_dev_urandom.h"
contrib/expat/lib/random_dev_urandom.h
+2
View File
@@ -27,6 +27,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if ! defined(RANDOM_DEV_URANDOM_H)
contrib/expat/lib/random_getentropy.c
+2
View File
@@ -28,6 +28,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "random_getentropy.h"
contrib/expat/lib/random_getentropy.h
+2
View File
@@ -27,6 +27,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if ! defined(RANDOM_GETENTROPY_H)
contrib/expat/lib/random_getrandom.c
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h" // for HAVE_GETRANDOM, HAVE_SYSCALL_GETRANDOM
contrib/expat/lib/random_getrandom.h
+2
View File
@@ -27,6 +27,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if ! defined(RANDOM_GETRANDOM_H)
contrib/expat/lib/random_rand_s.c
+2
View File
@@ -31,6 +31,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "random_rand_s.h"
contrib/expat/lib/random_rand_s.h
+2
View File
@@ -28,6 +28,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if ! defined(RANDOM_RAND_S_H)
contrib/expat/lib/siphash.h
+2
View File
@@ -8,6 +8,8 @@
*
* 1. https://www.131002.net/siphash/siphash24.c
* 2. https://www.131002.net/siphash/
*
* SPDX-License-Identifier: CC0-1.0
* --------------------------------------------------------------------------
* HISTORY:
*
contrib/expat/lib/utf8tab.h
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
/* 0x80 */ BT_TRAIL, BT_TRAIL, BT_TRAIL, BT_TRAIL,
contrib/expat/lib/xcsinc.c
+7 -1
View File
@@ -6,7 +6,7 @@
\___/_/\_\ .__/ \__,_|\__|
|_| XML parser
Copyright (c) 2022 Sebastian Pipping <sebastian@pipping.org>
Copyright (c) 2022-2026 Sebastian Pipping <sebastian@pipping.org>
Licensed under the MIT license:
Permission is hereby granted, free of charge, to any person obtaining
@@ -27,8 +27,14 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(XML_UNICODE) && defined(XML_UNICODE_WCHAR_T)
# include <wchar.h>
#endif
static size_t
xcslen(const XML_Char *s) {
#ifdef XML_UNICODE
contrib/expat/lib/xmlparse.c
+49 -25
View File
@@ -1,4 +1,4 @@
/* 5de44e6750c6cc78818f06ed552f522a1241df0299395250e1792cb339389daf (2.8.2+)
/* ee5f82c3ffd57c5224394ba46f348dbce466d34d6c925a527ae46b1cfe6adf1d (2.8.3+)
__ __ _
___\ \/ /_ __ __ _| |_
/ _ \\ /| '_ \ / _` | __|
@@ -50,6 +50,7 @@
Copyright (c) 2026 Nick Begg <nick@stunttruck.net>
Copyright (c) 2026 Kartik Kenchi <netliomax25@gmail.com>
Copyright (c) 2026 Haris Hussain <hextheshadow0x@gmail.com>
Copyright (c) 2026 Evgeny Kotkov <kotkov@apache.org>
Licensed under the MIT license:
Permission is hereby granted, free of charge, to any person obtaining
@@ -70,6 +71,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#define XML_BUILDING_EXPAT 1
@@ -93,10 +96,10 @@
#include <stddef.h>
#include <string.h> /* memset(), memcpy() */
#include <assert.h>
#include <limits.h> /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */
#include <limits.h> /* INT_MAX, UINT_MAX */
#include <stdio.h> /* fprintf */
#include <stdlib.h> /* getenv */
#include <stdint.h> /* SIZE_MAX, uintptr_t */
#include <stdint.h> /* SIZE_MAX, UINT64_MAX, uint64_t, uintptr_t */
#include <math.h> /* isnan */
#include <errno.h>
@@ -211,12 +214,6 @@ typedef char ICHAR;
#endif
#ifdef XML_LARGE_SIZE
# define XML_INDEX_MAX LLONG_MAX
#else
# define XML_INDEX_MAX LONG_MAX
#endif
/* Round up n to be a multiple of sz, where sz is a power of 2. */
#define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1))
@@ -719,7 +716,7 @@ struct XML_ParserStruct {
char *m_bufferEnd; // past last character to be parsed
const char *m_bufferLim; // allocated end of m_buffer
XML_Index m_parseEndByteIndex;
uint64_t m_parseEndByteIndex;
const char *m_parseEndPtr;
size_t m_partialTokenBytesBefore; /* used in heuristic to avoid O(n^2) */
XML_Bool m_reparseDeferralEnabled;
@@ -2312,7 +2309,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) {
int nLeftOver;
enum XML_Status result;
/* Detect overflow (a+b > MAX <==> b > MAX-a) */
if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) {
if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) {
parser->m_errorCode = XML_ERROR_NO_MEMORY;
parser->m_eventPtr = parser->m_eventEndPtr = NULL;
parser->m_processor = errorProcessor;
@@ -2430,7 +2427,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
}
// Detect and avoid integer overflow
if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) {
if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) {
parser->m_errorCode = XML_ERROR_NO_MEMORY;
parser->m_eventPtr = parser->m_eventEndPtr = NULL;
parser->m_processor = errorProcessor;
@@ -2692,9 +2689,15 @@ XML_Index XMLCALL
XML_GetCurrentByteIndex(XML_Parser parser) {
if (parser == NULL)
return -1;
if (parser->m_eventPtr)
if (parser->m_eventPtr) {
// NOTE: XML_Index is known to wrap around for >2 GiB content
// on 32bit machines and 64bit Windows, unless (non-default and
// uncommon) XML_LARGE_SIZE is defined.
// That's a bug and it only lives on because we cannot break
// ABI compatibility of public API.
return (XML_Index)(parser->m_parseEndByteIndex
- (parser->m_parseEndPtr - parser->m_eventPtr));
}
return -1;
}
@@ -2736,7 +2739,12 @@ XML_GetCurrentLineNumber(XML_Parser parser) {
parser->m_eventPtr, &parser->m_position);
parser->m_positionPtr = parser->m_eventPtr;
}
return parser->m_position.lineNumber + 1;
// NOTE: XML_Size is known to wrap around for >2 4iB content
// on 32bit machines and 64bit Windows, unless (non-default and
// uncommon) XML_LARGE_SIZE is defined.
// That's a bug and it only lives on because we cannot break
// ABI compatibility of public API.
return (XML_Size)(parser->m_position.lineNumber + 1);
}
XML_Size XMLCALL
@@ -2748,7 +2756,12 @@ XML_GetCurrentColumnNumber(XML_Parser parser) {
parser->m_eventPtr, &parser->m_position);
parser->m_positionPtr = parser->m_eventPtr;
}
return parser->m_position.columnNumber;
// NOTE: XML_Size is known to wrap around for >2 4iB content
// on 32bit machines and 64bit Windows, unless (non-default and
// uncommon) XML_LARGE_SIZE is defined.
// That's a bug and it only lives on because we cannot break
// ABI compatibility of public API.
return (XML_Size)parser->m_position.columnNumber;
}
void XMLCALL
@@ -3905,14 +3918,22 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
if (! attId)
return XML_ERROR_NO_MEMORY;
#ifdef XML_ATTR_INFO
// NOTE: XML_Index is known to wrap around for >2 GiB content
// on 32bit machines and 64bit Windows, unless (non-default and
// uncommon) XML_LARGE_SIZE is defined.
// That's a bug and it only lives on because we cannot break
// ABI compatibility of public API.
currAttInfo->nameStart
= parser->m_parseEndByteIndex - (parser->m_parseEndPtr - currAtt->name);
= (XML_Index)(parser->m_parseEndByteIndex
- (parser->m_parseEndPtr - currAtt->name));
currAttInfo->nameEnd
= currAttInfo->nameStart + XmlNameLength(enc, currAtt->name);
currAttInfo->valueStart = parser->m_parseEndByteIndex
- (parser->m_parseEndPtr - currAtt->valuePtr);
currAttInfo->valueEnd = parser->m_parseEndByteIndex
- (parser->m_parseEndPtr - currAtt->valueEnd);
currAttInfo->valueStart
= (XML_Index)(parser->m_parseEndByteIndex
- (parser->m_parseEndPtr - currAtt->valuePtr));
currAttInfo->valueEnd
= (XML_Index)(parser->m_parseEndByteIndex
- (parser->m_parseEndPtr - currAtt->valueEnd));
#endif
/* Detect duplicate attributes by their QNames. This does not work when
namespace processing is turned on and different prefixes for the same
@@ -6554,11 +6575,12 @@ storeAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata,
// Check if entity is complete, if not, mark down how much of it is
// processed. A XML_SUSPENDED check here is not required as
// appendAttributeValue will never suspend the parser.
if (textEnd != nextInEntity) {
if (nextInEntity < textEnd) {
entity->processed
= (int)(nextInEntity - (const char *)entity->textPtr);
continue;
}
assert(nextInEntity == textEnd);
// Entity is complete. We cannot close it here since we need to first
// process its possible inner entities (which are added to the
@@ -8192,7 +8214,7 @@ poolGrow(STRING_POOL *pool) {
pool->freeBlocks = tem;
memcpy(pool->blocks->s, pool->start,
(pool->end - pool->start) * sizeof(XML_Char));
pool->ptr = pool->blocks->s + (pool->ptr - pool->start);
pool->ptr = pool->blocks->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start);
pool->start = pool->blocks->s;
pool->end = pool->start + pool->blocks->size;
return XML_TRUE;
@@ -8205,7 +8227,8 @@ poolGrow(STRING_POOL *pool) {
/* NOTE: Needs to be calculated prior to calling `realloc`
to avoid dangling pointers: */
const ptrdiff_t offsetInsideBlock = pool->ptr - pool->start;
const ptrdiff_t offsetInsideBlock
= EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start);
if (blockSize < 0) {
/* This condition traps a situation where either more than
@@ -8268,8 +8291,9 @@ poolGrow(STRING_POOL *pool) {
tem->next = pool->blocks;
pool->blocks = tem;
if (pool->ptr != pool->start)
memcpy(tem->s, pool->start, (pool->ptr - pool->start) * sizeof(XML_Char));
pool->ptr = tem->s + (pool->ptr - pool->start);
memcpy(tem->s, pool->start,
EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start) * sizeof(XML_Char));
pool->ptr = tem->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start);
pool->start = tem->s;
pool->end = tem->s + blockSize;
}
contrib/expat/lib/xmlrole.c
+2
View File
@@ -37,6 +37,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h"
contrib/expat/lib/xmlrole.h
+2
View File
@@ -31,6 +31,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifndef XmlRole_INCLUDED
contrib/expat/lib/xmltok.c
+14 -3
View File
@@ -12,7 +12,7 @@
Copyright (c) 2002 Greg Stein <gstein@users.sourceforge.net>
Copyright (c) 2002-2016 Karl Waclawek <karl@waclawek.net>
Copyright (c) 2005-2009 Steven Solie <steven@solie.ca>
Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org>
Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
Copyright (c) 2016 Pascal Cuoq <cuoq@trust-in-soft.com>
Copyright (c) 2016 Don Lewis <truckman@apache.org>
Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk>
@@ -26,6 +26,7 @@
Copyright (c) 2023 Hanno Böck <hanno@gentoo.org>
Copyright (c) 2025 Alfonso Gregory <gfunni234@gmail.com>
Copyright (c) 2026 Nick Begg <nick@stunttruck.net>
Copyright (c) 2026 Kartik Kenchi <netliomax25@gmail.com>
Licensed under the MIT license:
Permission is hereby granted, free of charge, to any person obtaining
@@ -46,6 +47,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h"
@@ -705,9 +708,10 @@ unicode_byte_type(char hi, char lo) {
enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \
UNUSED_P(enc); \
fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \
/* Avoid copying first half only of surrogate */ \
/* Avoid copying the first half (2 bytes) of surrogate pairs (4 bytes) */ \
if (fromLim - *fromP > ((toLim - *toP) << 1) \
&& (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \
&& /* are the last two bytes a high surrogate (0xD800-0xDBFF)? */ \
(GET_HI(fromLim - 2) & 0xFC) == 0xD8) { \
fromLim -= 2; \
res = XML_CONVERT_INPUT_INCOMPLETE; \
} \
@@ -1177,6 +1181,13 @@ doParseXmlDecl(const ENCODING *(*encodingFinder)(const ENCODING *, const char *,
*versionPtr = val;
if (versionEndPtr)
*versionEndPtr = ptr;
/* The version number must not be empty; VersionNum requires at least
one character. The encoding and standalone pseudo-attributes below
already reject an empty value, so keep version consistent. */
if (val == ptr - enc->minBytesPerChar) {
*badPtr = val;
return 0;
}
if (! parsePseudoAttribute(enc, ptr, end, &name, &nameEnd, &val, &ptr)) {
*badPtr = ptr;
return 0;
contrib/expat/lib/xmltok.h
+7 -3
View File
@@ -10,7 +10,7 @@
Copyright (c) 2000 Clark Cooper <coopercc@users.sourceforge.net>
Copyright (c) 2002 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
Copyright (c) 2002-2005 Karl Waclawek <karl@waclawek.net>
Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org>
Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk>
Licensed under the MIT license:
@@ -32,11 +32,15 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifndef XmlTok_INCLUDED
# define XmlTok_INCLUDED 1
# include <stdint.h> // uint64_t
# ifdef __cplusplus
extern "C" {
# endif
@@ -145,8 +149,8 @@ extern "C" {
typedef struct position {
/* first line and first column are 0 not 1 */
XML_Size lineNumber;
XML_Size columnNumber;
uint64_t lineNumber;
uint64_t columnNumber;
} POSITION;
typedef struct {
contrib/expat/lib/xmltok_impl.c
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef XML_TOK_IMPL_C
contrib/expat/lib/xmltok_impl.h
+2
View File
@@ -29,6 +29,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
enum {
contrib/expat/lib/xmltok_ns.c
+2
View File
@@ -33,6 +33,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef XML_TOK_NS_C
contrib/expat/tests/acc_tests.c
+2
View File
@@ -39,6 +39,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h"
contrib/expat/tests/acc_tests.h
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/alloc_tests.c
+2
View File
@@ -41,6 +41,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(NDEBUG)
contrib/expat/tests/alloc_tests.h
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/basic_tests.c
+32 -1
View File
@@ -22,6 +22,7 @@
Copyright (c) 2024-2026 Berkay Eren Ürün <berkay.ueruen@siemens.com>
Copyright (c) 2026 Francesco Bertolaccini
Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>
Copyright (c) 2026 Kartik Kenchi <netliomax25@gmail.com>
Licensed under the MIT license:
Permission is hereby granted, free of charge, to any person obtaining
@@ -42,6 +43,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(NDEBUG)
@@ -51,7 +54,7 @@
#include "expat_config.h"
#include <assert.h>
#include <limits.h> // ULONG_MAX
#include <stdbool.h>
#include <stdio.h>
#include <string.h>
@@ -67,6 +70,21 @@
#include "siphash.h"
#include "basic_tests.h"
#define EXPAT_TESTS_ASAN 1
#if defined(__has_feature)
# if ! __has_feature(address_sanitizer)
# undef EXPAT_TESTS_ASAN
# define EXPAT_TESTS_ASAN 0
# endif
#endif
#if ULONG_MAX == 18446744073709551615u // 2^64-1
# define EXPAT_TESTS_64BIT 1
#else
# define EXPAT_TESTS_64BIT 0
#endif
static void
basic_setup(void) {
g_parser = XML_ParserCreate(NULL);
@@ -971,6 +989,14 @@ START_TEST(test_xmldecl_missing_value) {
}
END_TEST
START_TEST(test_xmldecl_empty_version) {
expect_failure("<?xml version=''?>\n"
"<doc/>",
XML_ERROR_XML_DECL,
"Failed to report empty version in XML declaration");
}
END_TEST
/* Regression test for SF bug #584832. */
START_TEST(test_unknown_encoding_internal_entity) {
const char *text = "<?xml version='1.0' encoding='unsupported-encoding'?>\n"
@@ -3429,12 +3455,16 @@ START_TEST(test_buffer_can_grow_to_max) {
if (s != XML_STATUS_OK)
xml_failure(parser);
// Avoid running into "AddressSanitizer: out of memory" on 32bit Windows
#if ! defined(_WIN32) || EXPAT_TESTS_ASAN == 0 || EXPAT_TESTS_64BIT == 1
// XML_CONTEXT_BYTES of the prefix may remain in the buffer;
// subtracting the whole prefix is easiest, and close enough.
assert_true(XML_GetBuffer(parser, maxbuf - prefix_len) != NULL);
// The limit should be consistent; no prefix should allow us to
// reach above the max buffer size.
assert_true(XML_GetBuffer(parser, maxbuf + 1) == NULL);
#endif
XML_ParserFree(parser);
}
}
@@ -6647,6 +6677,7 @@ make_basic_test_case(Suite *s) {
tcase_add_test(tc_basic, test_xmldecl_invalid);
tcase_add_test(tc_basic, test_xmldecl_missing_attr);
tcase_add_test(tc_basic, test_xmldecl_missing_value);
tcase_add_test(tc_basic, test_xmldecl_empty_version);
tcase_add_test__if_xml_ge(tc_basic, test_unknown_encoding_internal_entity);
tcase_add_test(tc_basic, test_unrecognised_encoding_internal_entity);
tcase_add_test__ifdef_xml_dtd(tc_basic, test_ext_entity_set_encoding);
contrib/expat/tests/basic_tests.h
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/chardata.c
+2
View File
@@ -33,6 +33,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(NDEBUG)
contrib/expat/tests/chardata.h
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/common.c
+2
View File
@@ -40,6 +40,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h"
contrib/expat/tests/common.h
+2
View File
@@ -39,6 +39,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/dummy.c
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat.h"
contrib/expat/tests/dummy.h
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/handlers.c
+2
View File
@@ -42,6 +42,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(NDEBUG)
contrib/expat/tests/handlers.h
+2
View File
@@ -41,6 +41,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/memcheck.c
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include <stdio.h>
contrib/expat/tests/memcheck.h
+2
View File
@@ -29,6 +29,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/minicheck.c
+2
View File
@@ -37,6 +37,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(NDEBUG)
contrib/expat/tests/minicheck.h
+2
View File
@@ -37,6 +37,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/misc_tests.c
+70 -1
View File
@@ -22,6 +22,7 @@
Copyright (c) 2025 Berkay Eren Ürün <berkay.ueruen@siemens.com>
Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>
Copyright (c) 2026 Kartik Kenchi <netliomax25@gmail.com>
Copyright (c) 2026 Evgeny Kotkov <kotkov@apache.org>
Licensed under the MIT license:
Permission is hereby granted, free of charge, to any person obtaining
@@ -42,6 +43,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(NDEBUG)
@@ -214,7 +217,7 @@ START_TEST(test_misc_version) {
if (! versions_equal(&read_version, &parsed_version))
fail("Version mismatch");
if (xcstrcmp(version_text, XCS("expat_2.8.2"))
if (xcstrcmp(version_text, XCS("expat_2.8.3"))
!= 0) /* needs bump on releases */
fail("XML_*_VERSION in expat.h out of sync?\n");
}
@@ -836,6 +839,70 @@ START_TEST(test_misc_resume_parser_forbidden_from_handler) {
}
END_TEST
// General attack payload idea by Jason Kratzer of Mozilla
START_TEST(test_misc_low_surrogate_mozilla_bug_2053153) {
const char doc_before[] = "<\0!\0D\0O\0C\0T\0Y\0P\0E\0 \0d\0 \0[\0\n\0"
" \0 \0<\0!\0E\0N\0T\0I\0T\0Y\0 \0e\0 \0'\0";
const char doc_after[] = "'\0>\0\n\0]\0>\0\n\0"
"<\0r\0 \0a\0=\0'\0&\0e\0;\0'\0/\0>\0\n\0";
for (size_t i = 1021; i <= 1025; i++) {
set_subtest("[%d]", (int)i);
XML_Parser parser = XML_ParserCreate(NULL);
assert_true(_XML_Parse_SINGLE_BYTES(parser, doc_before,
(int)sizeof(doc_before) - 1,
/*isFinal=*/XML_FALSE));
for (size_t j = 0; j < i; j++) {
assert_true(
_XML_Parse_SINGLE_BYTES(parser, "a\\0", 2, /*isFinal=*/XML_FALSE));
}
// Thinking Python, this is:
// ''.join([f'\\x{e:02x}' for e in '😀'.encode('UTF-16-LE')])
assert_true(_XML_Parse_SINGLE_BYTES(parser, "\x3d\xd8\x00\xde", 4,
/*isFinal=*/XML_FALSE));
assert_true(_XML_Parse_SINGLE_BYTES(
parser, doc_after, (int)sizeof(doc_after) - 1, /*isFinal=*/XML_TRUE));
XML_ParserFree(parser);
}
}
END_TEST
START_TEST(test_misc_input_2gb) {
XML_Parser parser;
const char *const doc = "<?xml version='1.0'?><doc/>";
unsigned long long offset = 0;
char buf[4096];
if (g_chunkSize != 0) {
return; // this test is slow, and doesn't use _XML_Parse_SINGLE_BYTES().
}
memset(buf, ' ', sizeof(buf));
parser = XML_ParserCreate(NULL);
assert_true(XML_Parse(parser, doc, (int)strlen(doc), XML_FALSE)
== XML_STATUS_OK);
offset += strlen(doc);
while (offset < 2ULL * 1024 * 1024 * 1024) {
assert_true(XML_Parse(parser, buf, sizeof(buf), XML_FALSE)
== XML_STATUS_OK);
offset += sizeof(buf);
}
assert_true(XML_Parse(parser, NULL, 0, XML_TRUE) == XML_STATUS_OK);
XML_ParserFree(parser);
}
END_TEST
void
make_miscellaneous_test_case(Suite *s) {
TCase *tc_misc = tcase_create("miscellaneous tests");
@@ -869,4 +936,6 @@ make_miscellaneous_test_case(Suite *s) {
tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161);
tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers);
tcase_add_test(tc_misc, test_misc_resume_parser_forbidden_from_handler);
tcase_add_test(tc_misc, test_misc_input_2gb);
tcase_add_test(tc_misc, test_misc_low_surrogate_mozilla_bug_2053153);
}
contrib/expat/tests/misc_tests.h
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/ns_tests.c
+2
View File
@@ -39,6 +39,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h"
contrib/expat/tests/ns_tests.h
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/nsalloc_tests.c
+2
View File
@@ -39,6 +39,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(NDEBUG)
contrib/expat/tests/nsalloc_tests.h
+2
View File
@@ -38,6 +38,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/tests/runtests.c
+2
View File
@@ -40,6 +40,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h"
contrib/expat/tests/structdata.c
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#if defined(NDEBUG)
contrib/expat/tests/structdata.h
+2
View File
@@ -28,6 +28,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/xmlwf/codepage.c
+2
View File
@@ -32,6 +32,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "codepage.h"
contrib/expat/xmlwf/codepage.h
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
int codepageMap(int cp, int *map);
contrib/expat/xmlwf/ct.c
+2
View File
@@ -29,6 +29,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#define CHARSET_MAX 41
contrib/expat/xmlwf/filemap.h
+2
View File
@@ -31,6 +31,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include <limits.h> /* INT_MAX */
contrib/expat/xmlwf/readfilemap.c
+2
View File
@@ -35,6 +35,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include <sys/types.h>
contrib/expat/xmlwf/unixfilemap.c
+2
View File
@@ -33,6 +33,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include <sys/types.h>
contrib/expat/xmlwf/win32filemap.c
+2
View File
@@ -31,6 +31,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#define STRICT 1
contrib/expat/xmlwf/xmlfile.c
+2
View File
@@ -39,6 +39,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h"
contrib/expat/xmlwf/xmlfile.h
+2
View File
@@ -31,6 +31,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#define XML_MAP_FILE 01
contrib/expat/xmlwf/xmlmime.c
+2
View File
@@ -30,6 +30,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include <string.h>
contrib/expat/xmlwf/xmlmime.h
+2
View File
@@ -29,6 +29,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#ifdef __cplusplus
contrib/expat/xmlwf/xmltchar.h
+2
View File
@@ -29,6 +29,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
/* Ensures compile-time constants are consistent */
contrib/expat/xmlwf/xmlwf.c
+2
View File
@@ -43,6 +43,8 @@
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
SPDX-License-Identifier: MIT
*/
#include "expat_config.h"
contrib/expat/xmlwf/xmlwf_helpgen.py
+2
View File
@@ -28,6 +28,8 @@
# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
# USE OR OTHER DEALINGS IN THE SOFTWARE.
#
# SPDX-License-Identifier: MIT
import argparse
from textwrap import dedent
contrib/expat/xmlwf/xmlwf_helpgen.sh
+2
View File
@@ -27,6 +27,8 @@
# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
# USE OR OTHER DEALINGS IN THE SOFTWARE.
#
# SPDX-License-Identifier: MIT
./xmlwf/xmlwf_helpgen.py | sed \
-e 's,usage: ,usage:,' \
lib/libexpat/expat_config.h
+3 -3
View File
@@ -89,7 +89,7 @@
#define PACKAGE_NAME "expat"
/* Define to the full name and version of this package. */
#define PACKAGE_STRING "expat 2.8.2"
#define PACKAGE_STRING "expat 2.8.3"
/* Define to the one symbol short name of this package. */
#define PACKAGE_TARNAME "expat"
@@ -98,7 +98,7 @@
#define PACKAGE_URL ""
/* Define to the version of this package. */
#define PACKAGE_VERSION "2.8.2"
#define PACKAGE_VERSION "2.8.3"
/* Define to 1 if all of the C89 standard headers exist (not just the ones
required in a freestanding environment). This macro is provided for
@@ -106,7 +106,7 @@
#define STDC_HEADERS 1
/* Version number of package */
#define VERSION "2.8.2"
#define VERSION "2.8.3"
/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
significant byte first (like Motorola and SPARC, unlike Intel). */
lib/libexpat/libbsdxml.3
+2 -2
View File
@@ -23,7 +23,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"/
.Dd June 25, 2026
.Dd August 10, 2026
.Dt LIBBSDXML 3
.Os
.Sh NAME
@@ -34,7 +34,7 @@
.Sh DESCRIPTION
The
.Nm
library is a verbatim copy of the eXpat XML library version 2.8.2.
library is a verbatim copy of the eXpat XML library version 2.8.3.
.Pp
The
.Nm